This is likely a simple one but what's the grok pattern for this? I have gone through all the ones I could find but I cant get a match for the format 03-MAR-21 00:40:2
Currently I am using a string but need to change it from a string to a time as its causing reporting issues
grok {
match => { "message" => [ "%{GREEDYDATA:timestamp}
}
date {
match => [ "timestamp", "dd-MMM-yy HH:mm:ss" ]
target => "@timestamp"
}
Thanks for the response.
I tried that but I get "_grokparsefailure". If I try "%{TIMESTAMP_ISO8601:timestamp}" on the grok debugger tool it fails as well.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.